IBM Langflow CVE-2026-8859

Exploitation requires the APIRequest component's 'Save to File' feature to be explicitly enabled (a non-default setting), and a Langflow flow that issues an HTTP request to a server the attacker controls or can poison - the attacker must sit on that upstream endpoint to inject a malicious Content-Disposition filename containing '../' sequences. What limits exploitation: the Save-to-File option must be on, the victim flow must target an attacker-influenced host, and writes are bounded to paths the Langflow OS process can access, so a low-privilege, filesystem-restricted deployment sharply narrows impact. Per CVSS PR:L, some authenticated/low-privilege access to author or run the relevant flow is involved rather than fully unauthenticated exploitation of a default install.

IBM's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, score 9.9) reflects a network-reachable, low-privilege, scope-changing file write with full CIA impact - an arbitrary write primitive that commonly escalates to remote code execution by overwriting code, startup scripts, or configuration. However, the raw score understates real-world preconditions: exploitation requires the non-default 'Save to File' feature to be enabled AND a Langflow flow that issues an outbound request to a server the attacker controls (or can poison), which is a meaningful gate. EPSS is not provided, KEV status is NO, and no POC is referenced, so there is no evidence of active or automated exploitation today. The honest read is a genuinely high-severity latent risk (write-to-RCE) whose likelihood is throttled by configuration and by the attacker needing to sit on the upstream HTTP endpoint the victim flow calls; treat as high priority for any deployment that enables Save-to-File or lets untrusted users author flows, and lower priority for locked-down default installs. Note the C:H rating is somewhat generous for a pure write primitive - confidentiality impact is largely indirect via file-write-to-RCE.

An attacker stands up (or compromises) an HTTP endpoint that a Langflow flow's APIRequest component is configured to call with 'Save to File' enabled. When the flow fetches the URL, the attacker's response includes a Content-Disposition header such as filename="../../app/startup.py", causing Langflow to write attacker-supplied content outside the temp directory and potentially achieve code execution on the next process load. No public POC is currently identified, but the low attack complexity of the underlying traversal makes weaponization straightforward once the feature and upstream endpoint conditions are met.